Monitor Certificate Transparency logs using crt.sh and Certstream to detect phishing domains, lookalike certificates, and unauthorized certificate issuance targeting your organization.

Analyzing Certificate Transparency for Phishing Overview Certificate Transparency (CT) is an Internet security standard that creates a public, append only log of all issued SSL/TLS certificates. Monitoring CT logs enables early detection of phishing domains that register certificates mimicking legitimate brands, unauthorized certificate issuance for owned domains, and certificate based attack infrastructure. This skill covers querying CT logs via crt.sh, real time monitoring with Certstream, building automated alerting for suspicious certificates, and integrating findings into threat intelligence workflows. When to Use When investigating security incidents that require analyzing certificate transparency for phishing When building detection rules or threat hunting queries for this domain When SOC analysts need structured procedures for this analysis type When validating security monitoring coverage for related attack techniques Prerequisites Python 3.9+ with requests , certstream , tldextract , Levenshtein libraries Access to crt.sh (https://crt.sh/) for historical CT log queries Certstream (https://certstream.calidog.io/) for real time monitoring List of organization domains and brand keywords to monitor Understanding of SSL/TLS certificate structure and issuance process Key Concepts Certificate Transparency Logs CT logs are cryptographically assured, publicly auditable, append only records of TLS certificate issuance. Major CAs (Let's Encrypt, DigiCert, Sectigo, Google Trust Services) submit all issued certificates to multiple CT logs. As of 2025, Chrome and Safari require CT for all publicly trusted certificates. Phishing Detection via CT Attackers register lookalike domains and obtain free certificates (often from Let's Encrypt) to make phishing sites appear legitimate with HTTPS. CT monitoring detects these early because the certificate appears in logs before the phishing campaign launches, providing a window for proactive blocking. crt.sh Database crt.sh is a free web interface and PostgreSQL database operated by Sectigo that indexes CT logs. It supports wildcard searches ( %.example.com ), direct SQL queries, and JSON API responses. It tracks certificate issuance, expiration, and revocation across all major CT logs. Workflow Step 1: Query crt.sh for Certificate History Step 2: Real Time Monitoring with Certstream Step 3: Enumerate Subdomains from CT Logs Step 4: Generate CT Intelligence Report Validation Criteria crt.sh queries return certificate data for target domains Suspicious certificates identified based on lookalike patterns Certstream real time monitoring detects new phishing certificates Subdomain enumeration produces comprehensive list from CT logs Alerts generated with reason classification CT intelligence report created with actionable recommendations References [crt.sh Certificate Search](https://crt.sh/) [Certstream Real Time CT Monitor](https://certstream.calidog.io/) [River Security: CT Logs for Attack Surface Discovery](https://riversecurity.eu/finding attack surface and fraudulent domains via certificate transparency logs/) [Let's Encrypt: Certificate Transparency Logs](https://letsencrypt.org/docs/ct logs/) [SSLMate Cert Spotter](https://sslmate.com/certspotter/) [CyberSierra: CT Logs as Early Warning System](https://cybersierra.co/blog/ssl certificate transparency logs/)

analyzing-certificate-transparency-for-phishing